CVE-2026-45044 Details
Description
RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.2, the admin router explicitly whitelists /profile/cpu and /profile/memory from the authentication layer, allowing any unauthenticated HTTP client to invoke profiling handlers without credentials. On supported builds (e.g., glibc), the handler invokes a fixed 60-second CPU profiling operation (dump_cpu_pprof_for(Duration::from_secs(60))). This may result in significant CPU resource consumption per request and can potentially lead to denial of service when abused. Additionally, the handler returns the server’s absolute filesystem path in the response body, resulting in information disclosure. This vulnerability is fixed in 1.0.0-beta.2.
An authentication bypass vulnerability has been identified in RustFS, a distributed object storage system, prior to version 1.0.0-beta.2. The admin router whitelists the endpoints '/profile/cpu' and '/profile/memory', allowing unauthenticated HTTP clients to access profiling handlers. On supported builds, such as those using glibc, this exploitation triggers a 60-second CPU profiling operation, which can consume significant server resources and potentially lead to a denial-of-service condition. Furthermore, the profiling handler discloses the server's absolute filesystem path in the response, creating an information disclosure risk. On musl/Docker builds, the authentication bypass is indicated by a '500 Internal Server Error' response, showing that the request bypassed authentication and reached the handler.
Users are advised to update to RustFS version 1.0.0-beta.2 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 28, 2026CISA-ADP
Assessed May 28, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/rustfs/rustfs/security/advisories/GHSA-8784-9m7f-c6p6 | CISA-ADP | AdvisoryExploitTechnical DescriptionVendor |
| https://github.com/rustfs/rustfs/security/advisories/GHSA-8784-9m7f-c6p6 | [email protected] | AdvisoryExploitTechnical DescriptionVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-306 | Missing Authentication for Critical Function | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| RustFS | < 1.0.0-beta.2 (semver) |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 28, 2026 | CVE Modified | CISA-ADP |
| May 28, 2026 | New CVE Received | [email protected] |